CVE-2015-0816

Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource: URLs, which makes it easier for…

published April 1, 2015

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.3th percentile for exploit probability.

CVSS
—
EPSS
66%
Percentile
99.3
In the wild
Unconfirmed
What it is

Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource: URLs, which makes it easier for remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging the ability to bypass the Same Origin Policy, as demonstrated by the resource: URL associated with PDF.js.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.65529 · 99.3th percentile
Published
2015-04-01T10:00Z
EPSS history
Timeline
  • 01 APR 10:00Z
    Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource: URLs, which makes it easier for…
    cvelistv5